CVE-2026-103303 PUBLISHED

Turisbook Booking System <= 1.3.8 - Unauthenticated Stored XSS via Cart Background Setting

Assigner: WPScan
Reserved: 30.09.2026 Published: 08.11.2026 Updated: 08.11.2026

The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.

Product Status

Vendor Unknown
Product Turisbook Booking System
Versions Default: unknown
  • affected from 0 to 1.3.8 (incl.)

Credits

  • Naiches finder
  • WPScan coordinator

References

Problem Types

  • CWE-79 Cross-Site Scripting (XSS) CWE
  • CWE-352 Cross-Site Request Forgery (CSRF) CWE